On Sun, 2009-06-21 at 23:21 +0200, mouss wrote:
> John Hardin a écrit :
>
> > /\(\s?w{2,4}\smeds\d{1,4}\s(?:net|com|org)\s?\)/
>
> you can replace "meds" by "(meds|shop)" to catch the "www shop95 net"
> variants.
body URI_OBFU_MEDSHOP /\(\s?w{2,4}\s(?:meds|shop)\d{1,4}\s(?:net|com|
org)\s?\)/
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
